A64: Fix write barrier input in KeyedStoreIC::GenerateSloppyArguments.

src/a64/ic-a64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 374 matching lines @@
       FixedArray::kHeaderSize + 2 * kPointerSize - kHeapObjectTag;
 
   __ Add(scratch1, map, offset);
   __ SmiUntag(scratch2, key);
   __ Ldr(scratch1, MemOperand(scratch1, scratch2, LSL, kPointerSizeLog2));
   __ JumpIfRoot(scratch1, Heap::kTheHoleValueRootIndex, unmapped_case);
 
   // Load value from context and return it.
   __ Ldr(scratch2, FieldMemOperand(map, FixedArray::kHeaderSize));
   __ SmiUntag(scratch1);
-  __ Add(scratch2, scratch2, Context::kHeaderSize - kHeapObjectTag);
-  return MemOperand(scratch2, scratch1, LSL, kPointerSizeLog2);
+  __ Lsl(scratch1, scratch1, kPointerSizeLog2);
+  __ Add(scratch1, scratch1, Context::kHeaderSize - kHeapObjectTag);
+  // The base of the result (scratch2) is passed to RecordWrite in
+  // KeyedStoreIC::GenerateSloppyArguments and it must be a HeapObject.
+  return MemOperand(scratch2, scratch1);
 }
 
 
 // The 'parameter_map' register must be loaded with the parameter map of the
 // arguments object and is overwritten.
 static MemOperand GenerateUnmappedArgumentsLookup(MacroAssembler* masm,
                                                   Register key,
                                                   Register parameter_map,
                                                   Register scratch,
                                                   Label* slow_case) {
@@ skipping 988 matching lines @@
     ASSERT(to_patch->Mask(TestBranchMask) == TBNZ);
     // This is JumpIfSmi(smi_reg, branch_imm).
     patcher.tbz(smi_reg, 0, branch_imm);
   }
 }
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_A64